CN112333025A - Network security simulation training method, device and system - Google Patents
Network security simulation training method, device and system Download PDFInfo
- Publication number
- CN112333025A CN112333025A CN202011304202.7A CN202011304202A CN112333025A CN 112333025 A CN112333025 A CN 112333025A CN 202011304202 A CN202011304202 A CN 202011304202A CN 112333025 A CN112333025 A CN 112333025A
- Authority
- CN
- China
- Prior art keywords
- target
- virtualization
- information
- user
- security
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000012549 training Methods 0.000 title claims abstract description 99
- 238000000034 method Methods 0.000 title claims abstract description 47
- 238000004088 simulation Methods 0.000 title claims abstract description 46
- 238000012795 verification Methods 0.000 claims description 15
- 238000001514 detection method Methods 0.000 claims description 8
- 241000700605 Viruses Species 0.000 claims description 7
- 230000008569 process Effects 0.000 claims description 6
- 230000002452 interceptive effect Effects 0.000 claims description 2
- 238000010586 diagram Methods 0.000 description 12
- 230000006870 function Effects 0.000 description 11
- 230000006855 networking Effects 0.000 description 8
- 238000004891 communication Methods 0.000 description 7
- 238000004590 computer program Methods 0.000 description 6
- 238000012545 processing Methods 0.000 description 5
- 238000010276 construction Methods 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 230000006872 improvement Effects 0.000 description 2
- 230000001154 acute effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000007596 consolidation process Methods 0.000 description 1
- 238000005336 cracking Methods 0.000 description 1
- 230000007123 defense Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- ZXQYGBMAQZUVMI-GCMPRSNUSA-N gamma-cyhalothrin Chemical compound CC1(C)[C@@H](\C=C(/Cl)C(F)(F)F)[C@H]1C(=O)O[C@H](C#N)C1=CC=CC(OC=2C=CC=CC=2)=C1 ZXQYGBMAQZUVMI-GCMPRSNUSA-N 0.000 description 1
- 238000002513 implantation Methods 0.000 description 1
- 238000002347 injection Methods 0.000 description 1
- 239000007924 injection Substances 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000013515 script Methods 0.000 description 1
- 238000007789 sealing Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 239000000243 solution Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45562—Creating, deleting, cloning virtual machine instances
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45587—Isolation or security of virtual machine instances
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45595—Network integration; Enabling network access in virtual machine instances
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the disclosure discloses a network security simulation training method, a device and a system, wherein the method comprises the following steps: receiving a training request for calling target safety equipment sent by a user; the training request at least comprises a target device type and user identification information; determining related information of the existing safety equipment according to the training request; determining the operating environment information of the target equipment according to the training request after determining that no virtualization instance corresponding to the idle existing safety equipment with the target equipment type exists according to the related information; sending the running environment information to a network security virtualization platform to request the network security virtualization platform to establish a virtualization instance corresponding to the target security device and virtualization instances of other devices in the running environment of the target security device according to physical resources required by the running environment information; and receiving the management information of the established virtualization instance from the network security virtualization platform and returning the management information to the user.
Description
Technical Field
The disclosure relates to the technical field of computers, in particular to a network security simulation training method, device and system.
Background
The important guarantee of the safe and controllable operation of the safety protection basic network, the information safety construction has been promoted to the national safety strategy height, and higher requirements are also put forward for the network safety talent cultivation. However, since the network security devices are all network operation devices, configuration practice is inconvenient, and no special device is provided for operators to practice, which affects the consolidation and improvement of service level; in addition, network security equipment is expensive, and for some departments, it is difficult to practice by equipping multiple sets of equipment. Especially for units implementing centralized training like colleges and universities, the increasing training requires that the practical number of colleges and universities is insufficient, the contradiction is more and more acute, and the mastering and improvement of the practical operation capacity of students are limited. In addition, most of network security equipment provided by security manufacturers is integrated with soft and hard, so that the system has strong sealing property, high experiment teaching use cost, insufficient networking flexibility and inextensible resources, and is not suitable for the requirements of a large number of students in centralized training in schools.
Disclosure of Invention
The embodiment of the disclosure provides a network security simulation training method, device and system.
In a first aspect, an embodiment of the present disclosure provides a network security simulation training method, including:
receiving a training request of target safety equipment sent by a user; the training request at least comprises a target device type and user identification information;
determining related information of the existing safety equipment according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment;
determining running environment information of the target equipment according to the training request after determining that no virtualization instance corresponding to the existing safety equipment which is idle and has the target equipment type exists according to the related information;
sending the running environment information to a network security virtualization platform to request the network security virtualization platform to establish a virtualization instance corresponding to the target security device and virtualization instances of other devices in the running environment of the target security device according to physical resources required by the running environment information;
and receiving the established management information of the virtualization instance from the network security virtualization platform and returning the management information to the user so that the user can use the virtualization instance according to the management information.
Further, still include:
and after determining that the virtualization instances corresponding to the idle existing safety equipment with the target equipment type exist according to the related information, determining the existing safety equipment as the target safety equipment, and returning the management information corresponding to the target safety equipment to the user so that the user can use the target safety equipment and the virtualization instances corresponding to other equipment in the running environment of the target safety equipment according to the management information.
Further, still include:
and binding and storing the user identification information and the virtualized instance identification, and marking the use state of the virtualized instance as occupied.
Further, still include:
and when detecting that the user does not use the virtualized instance of the target security device within a preset time period, unbinding the user identification information and the virtualized instance identification, and marking the use state of the virtualized instance as idle.
Further, still include:
receiving configuration information of a virtualization instance corresponding to the target security equipment by the user;
configuring the target security equipment according to the configuration information;
and receiving a verification request of the user for the configuration information, executing the verification request on the virtualized instance of the target security equipment according to the configuration information, and returning a verification result.
Further, the configuration information includes at least one of: stand-alone exercise environment configuration information, comprehensive exercise environment configuration information, and confrontation exercise environment configuration information.
Further, the physical resources include at least one of: physical machines, servers, routers, and switches; the target security device runs on a virtual machine, and the virtual machine is established on the physical machine; the virtualized instance of the other device includes at least one of: virtual switch, virtual router, virtual server, virtual terminal.
Further, the target security device includes at least one of: the system comprises a firewall, an intrusion detection device, a vulnerability scanning device, a virus protection system and a patch distribution system.
In a second aspect, an embodiment of the present invention provides a full-equipment simulation training apparatus, including:
the first receiving module is configured to receive a training request of a target safety device sent by a user; the training request at least comprises a target device type and user identification information;
a first determination module configured to determine information related to an existing security device according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment;
a second determining module, configured to determine, according to the relevant information, after determining that there is no virtualization instance corresponding to the existing idle security device having the target device type, operation environment information of the target device according to the training request;
a sending module configured to send the operating environment information to a network security virtualization platform to request the network security virtualization platform to establish a virtualized instance corresponding to the target security device and virtualized instances of other devices in an operating environment of the target security device according to physical resources required by the operating environment information;
a return module configured to receive the established management information of the virtualization instance from the network security virtualization platform and return the management information to a user so that the user can use the virtualization instance according to the management information.
In a third aspect, an embodiment of the present invention provides a network security simulation training system, including: the system comprises a client, a web server and a network security virtualization platform; wherein,
the client is used for providing a web interactive interface for a user;
the web server is used for receiving a training request of a client, wherein the training request at least comprises a target equipment type and user identification information of target safety equipment called by a user; the web server also determines the related information of the existing safety equipment according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment; the web server is used for determining running environment information of the target equipment according to the training request after determining that no virtualization instance corresponding to the existing idle safety equipment with the target equipment type exists according to the related information, and sending the running environment information to a network security virtualization platform; the web server also receives the established management information of the virtualization instance from the network security virtualization platform and returns the management information to the client, so that a user can use the virtualization instance through the client according to the management information;
and the network security virtualization platform receives a request of the web server, and establishes a virtualization instance corresponding to the target security device and virtualization instances of other devices in the operating environment of the target security device according to physical resources required by the operating environment information in the request.
Further, the network security virtualization platform comprises: a physical layer, a virtual layer, and a device layer; wherein,
the physical layer comprises a physical machine for bearing a virtual machine;
the virtual layer includes a virtual machine built on the physical machine, a virtualized instance of a target security appliance running on the virtual machine,
the device layer comprises a network security simulation training example established on the virtual machine, the virtualization example is used for simulating the operation and configuration process of the security device, and the training network with different topological structures corresponding to the security device is simulated by utilizing virtualization network resources.
Further, the physical machine includes at least one of: a server, a router and a storage array; the network security simulation training example comprises at least one of the following: the system comprises a firewall, intrusion detection equipment, vulnerability scanning equipment, a virus protection system, a patch distribution system, a virtual server and a virtual client.
The functions can be realized by hardware, and the functions can also be realized by executing corresponding software by hardware. The hardware or software includes one or more modules corresponding to the above-described functions.
In one possible design, the apparatus includes a memory configured to store one or more computer instructions that enable the apparatus to perform the corresponding method, and a processor configured to execute the computer instructions stored in the memory. The apparatus may also include a communication interface for the apparatus to communicate with other devices or a communication network.
In a third aspect, an embodiment of the present disclosure provides an electronic device, including a memory and a processor; wherein the memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method of any of the above aspects.
In a fourth aspect, the disclosed embodiments provide a computer-readable storage medium for storing computer instructions for use by any of the above-mentioned apparatuses, including computer instructions for performing the method according to any of the above-mentioned aspects.
The technical scheme provided by the embodiment of the disclosure can have the following beneficial effects:
the embodiment of the disclosure provides a network security simulation training method, which includes: receiving a training request of target safety equipment sent by a user; the training request at least comprises a target device type and user identification information; determining related information of the existing safety equipment according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment; determining running environment information of the target equipment according to the training request after determining that no virtualization instance corresponding to the existing safety equipment which is idle and has the target equipment type exists according to the related information; sending the running environment information to a network security virtualization platform to request the network security virtualization platform to establish a virtualization instance corresponding to the target security device and virtualization instances of other devices in the running environment of the target security device according to physical resources required by the running environment information; and receiving the established management information of the virtualization instance from the network security virtualization platform and returning the management information to the user so that the user can use the virtualization instance according to the management information. The method realizes the software self-defined construction of the network security learning environment through the security equipment and the network virtualization; the training requirements of safety equipment of more users can be met by simply expanding general computing and storage resources. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
Other features, objects, and advantages of the present disclosure will become more apparent from the following detailed description of non-limiting embodiments when taken in conjunction with the accompanying drawings. In the drawings:
FIG. 1 shows a flow diagram of a network security simulation training method according to an embodiment of the present disclosure;
FIG. 2 illustrates a flow diagram for verifying security device configuration information according to the embodiment illustrated in FIG. 1;
FIG. 3 is a block diagram of a network security simulation training apparatus according to an embodiment of the present disclosure;
FIG. 4 is a block diagram of a network security simulation training system according to an embodiment of the present disclosure;
fig. 5 is a schematic structural diagram of an electronic device suitable for implementing a network security simulation training method according to an embodiment of the present disclosure.
Detailed Description
Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. Also, for the sake of clarity, parts not relevant to the description of the exemplary embodiments are omitted in the drawings.
In the present disclosure, it is to be understood that terms such as "including" or "having," etc., are intended to indicate the presence of the disclosed features, numbers, steps, behaviors, components, parts, or combinations thereof, and are not intended to preclude the possibility that one or more other features, numbers, steps, behaviors, components, parts, or combinations thereof may be present or added.
It should be further noted that the embodiments and features of the embodiments in the present disclosure may be combined with each other without conflict. The present disclosure will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.
The details of the embodiments of the present disclosure are described in detail below with reference to specific embodiments.
Fig. 1 shows a flow chart of a network security simulation training method according to an embodiment of the present disclosure. As shown in fig. 1, the method comprises the steps of:
in step S101, a training request of a target security device sent by a user is received; the training request at least comprises a target device type and user identification information;
in step S102, determining relevant information of existing security devices according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment;
in step S103, after determining that there is no virtualized instance corresponding to the existing idle security device having the target device type according to the relevant information, determining operating environment information of the target device according to the training request;
in step S104, sending the operating environment information to a network security virtualization platform to request the network security virtualization platform to establish a virtualization instance corresponding to the target security device and virtualization instances of other devices in an operating environment of the target security device according to physical resources required by the operating environment information;
in step S105, the management information of the created virtualization instance is received from the network security virtualization platform and returned to the user, so that the user can use the virtualization instance according to the management information.
In this embodiment, the network security simulation training method is executed on a web server.
In some embodiments, the embodiments of the present disclosure provide a network security simulation training system, where the entire system adopts a B/S + R structure, where B/S may be a common website architecture, and R may be a manner of logging in to a virtual machine remotely. The function of each part of the system will be briefly described below.
1) And (4) a client. The user submits a training request of a required target security device to the Web server through the client, wherein the training request can include but is not limited to a type of the target security device and user identification information. The target security device types may include, but are not limited to, one or more of a firewall, an intrusion detection device, a vulnerability scanning device, a virus protection system, and a patch distribution system. The user identification information may be a user ID registered by the user in the system or a user ID allocated by the system for the user, and may be specifically set according to an actual situation, which is not limited herein. After receiving a training request of a user, the Web server can request to create a virtualized instance of the target security device through the network security virtualization platform, the network security virtualization platform can return created virtualized instance information to the Web server, the Web server returns the created virtualized instance information to the user, and the user can remotely log in the virtualized instance running on the virtual machine according to the virtualized instance information to perform simulation exercise of the target security device. It will be appreciated that if a virtualized instance of the target security device requested by the user already exists in the system (e.g., a target security device created by a previous user and no longer being used), the web server may directly return the existing security device information to the user, who may remotely log into the existing security device through the received information to perform a simulation exercise.
2) And a Web server. The method comprises the steps that a user enters a simulation exercise of the safety equipment, the user sends a training request to a web server through a web page on a client, and after the web receives the training request, whether existing safety equipment which is matched with a target safety equipment type requested by the user and is in an idle use state exists is judged; if the network environment information does not exist, determining the operating environment information of the target security device, for example, networking topology information of the security target device, other devices used in the networking topology information, and the like, and then sending the operating environment information (including the number of virtual machines, configuration information, network topology information, and the like) to the network virtualization platform to request the network virtualization platform to calculate the physical resources required by the target security device according to the operating environment, and establish virtualization instances of the target security device and the other devices, and return the created virtualization instance information of the target security device and the other devices, the networking environment information, and the like to the web server, which returns the created virtualization instance information of the target security device and the other devices and the networking environment information to the user. After creating the virtualized instance of the target security device, the user may select exercise content of the target security device to be performed, such as theoretical learning, device exercise, and the like, through the web server. The management information of the virtualized instance received by the web server from the network security virtualization platform includes, but is not limited to, virtualized instance information of the target security device, virtualized instance information of other devices in a network topology structure where the target security device is located, and network topology information.
3) A physical machine. The virtual machine belongs to a network safety virtualization platform, is a place where a virtual machine is actually created and operated, and bears various virtual safety devices on the virtual machine. A plurality of physical machines with higher configuration are mainly adopted to form a back-end cluster. The physical machine has the function in the platform system of executing corresponding scripts according to commands transmitted by the Web server, and completing the work of creating, configuring, destroying and the like of the virtual machine in the machine.
4) A virtual switch. The virtual machine network topology belongs to a network safety virtualization platform, is a virtualized device, performs network division by adopting the generated virtual machine, and is very flexible by virtue of the virtual switches.
5) A virtual router. The method belongs to a network safety virtualization platform, and a router software system is adopted to construct a virtual router in a virtual host mode, so as to construct a network with a more complex topological structure.
6) And a platform management machine. The method belongs to a network security virtualization platform and mainly realizes functions of user data, operation process storage, exercise data maintenance, virtual environment configuration and the like.
7) A data server belongs to a network security virtualization platform and is mainly used for storing system data.
In some embodiments, the target security devices may include, but are not limited to, firewalls, intrusion detection devices, vulnerability scanning devices, virus protection systems, patch distribution systems, and the like.
The software self-defined construction of the network security learning environment is realized through the security equipment and the network virtualization in the embodiment of the disclosure; the training requirements of safety equipment of more users can be met by simply expanding general computing and storage resources.
In an optional implementation manner of this embodiment, the method further includes:
and after determining that the virtualization instances corresponding to the idle existing safety equipment with the target equipment type exist according to the related information, determining the existing safety equipment as the target safety equipment, and returning the management information corresponding to the target safety equipment to the user so that the user can use the target safety equipment and the virtualization instances corresponding to other equipment in the running environment of the target safety equipment according to the management information.
In this optional implementation manner, after receiving a training request of a target security device generated by a user through a client, a web server searches relevant information of an existing security device in a system, where the relevant information may include, but is not limited to, the number of virtualization instances corresponding to the existing security device and a usage state. If the existing network security simulation training instance which is the same as the target security device in type and is idle in use state exists, the existing network security simulation training instance is determined as the virtualization instance of the target security device, and information of the existing network security simulation training instance and virtualization instance information, network topology information and the like of other devices in a network topology structure where the virtualization instance of the target security device is located are returned to the client side together, so that a user can remotely log in an operating environment where the virtualization instance of the target security device is located through the information, and perform security configuration, security verification and the like on the virtualization instance of the target security device, and simulation exercises of the target security device are completed.
In an optional implementation manner of this embodiment, the method further includes:
and binding and storing the user identification information and the virtualized instance identification, and marking the use state of the virtualized instance as occupied.
In this optional implementation manner, the web server further binds and stores the user identification information and the identification of the target secure device and/or the identification of the virtualized instances of other devices in the operating environment where the target secure device is located, and marks these virtualized instances in an occupied state, so that the target secure device and other devices in the operating environment thereof are used by the user, and are prevented from being occupied by other users in the process of using the user.
In an optional implementation manner of this embodiment, the method further includes:
and when detecting that the user does not use the virtualized instance of the target security device within a preset time period, unbinding the user identification information and the virtualized instance identification, and marking the use state of the virtualized instance as idle.
In this optional implementation manner, the web server may further obtain the usage status of the virtualized instance of the target security device from the network virtualization platform, and if the current user does not use the target security device within a preset time period, the usage right of the target security device may be recovered so as to be provided to other users for use. The Web server can recover the use authority of the user by unbinding the user identification information and the virtualized instance identification and marking the use state of the virtualized instance as idle. It can be understood that, when a user logs in a virtualized instance of a target security device remotely, identity information such as user identification information, a password, and the like needs to be provided, and the web server may also verify whether the user identification has a binding relationship with a virtualized instance identification of the target security device to be logged in currently, if the user identification and the password are verified to be legal, the user is not allowed to log in the virtualized instance of the target security device.
In an optional implementation manner of this embodiment, as shown in fig. 2, the method further includes the following steps:
in step S201, receiving configuration information of the user for a virtualized instance corresponding to the target security device;
in step S202, configuring the target security device according to the configuration information;
in step S203, a verification request of the user for the configuration information is received, the verification request is executed on the virtualized instance of the target security device according to the configuration information, and the verification result is returned.
In this optional implementation manner, after requesting to obtain the virtualization instance information of the virtualization instance of the target security device, the user may log in the virtualization instance of the target security device, perform security configuration on the virtualization instance, and then perform verification according to the security configuration, so that the purpose of simulation exercise of the target security device may be achieved by this manner. For example, when the target security device is a firewall, the web server may return a management configuration interface (which is a firewall having the same function as a physical firewall) and a firewall training environment (e.g., a virtual server and a virtual computer terminal) to the client with respect to the firewall, and after the user configures the firewall, the user may pass the terminal verification, and whether the firewall successfully protects the service area, and whether the configuration is correct, or not, and the like.
In an optional implementation manner of this embodiment, the configuration information includes at least one of: stand-alone exercise environment configuration information, comprehensive exercise environment configuration information, and confrontation exercise environment configuration information.
In this alternative implementation, the user may configure the virtualized instance of the target security device based on his or her exercise needs, for example, the configuration information may include, but is not limited to, stand-alone exercise environment configuration information, integrated exercise environment configuration information, and confrontation exercise environment configuration information. The single machine practice adopts an operation interface, a configuration method, configuration steps and the like which are completely the same as those of the active equipment, simulates various operation flows of single safety equipment, solves the problem of no special network safety practice equipment, and mainly completes the simulation operation of single equipment such as a main stream firewall, vulnerability scanning and intrusion detection equipment. The comprehensive exercise environment is used for realizing equipment networking in a virtual networking environment on the basis of single-machine exercise, various comprehensive exercise subjects can be developed, the effectiveness of various configurations is verified through the actual protection effect, and the problem that the comprehensive utilization capacity of the equipment of an operator is insufficient is solved. The countermeasure exercise can develop network attack exercise contents including DDoS attack, buffer overflow attack, ARP deception attack, network sniffing attack, Trojan horse implantation, SQL injection, password cracking, malicious code release, honeypot trapping, attack log clearing and the like by constructing a virtual attack and defense exercise environment, and attack is carried out on a set target network or a system by using an equipped attack tool in the virtual environment.
In an optional implementation manner of this embodiment, the physical resource includes at least one of: physical machines, servers, routers, and switches; the target security device runs on a virtual machine, and the virtual machine is established on the physical machine; the virtualized instance of the other device includes at least one of: virtual switch, virtual router, virtual server, virtual terminal.
In this optional implementation manner, the virtualized instance of the target security device is created on a virtual machine, and the virtual machine uses a physical machine on the network security virtualized platform as an operating entity, and in order to implement remote use of the network security simulation training instance by a user, a physical server, a physical router, and a physical switch may be deployed in the network security virtualized platform, so that each physical machine running the virtual machine can implement remote network communication with the client through the server, the router, and the switch. Besides the network security simulation training example, a virtual switch, a virtual router, a virtual server, a virtual terminal and the like can be operated on the virtual machine, so that a virtual networking environment can be formed with the security device.
The following are embodiments of the disclosed apparatus that may be used to perform embodiments of the disclosed methods.
Fig. 3 is a block diagram of a network security simulation training apparatus according to an embodiment of the present disclosure. As shown in fig. 3, the apparatus may be implemented as part or all of an electronic device by software, hardware, or a combination of both. The network safety simulation training device comprises:
a first receiving module 301, configured to receive a training request of a target security device sent by a user; the training request at least comprises a target device type and user identification information;
a first determining module 302 configured to determine information related to an existing security device according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment;
a second determining module 303, configured to determine, according to the relevant information, after determining that there is no virtualized instance corresponding to the existing idle security device having the target device type, operation environment information of the target device according to the training request;
a sending module 304, configured to send the operating environment information to a network security virtualization platform to request the network security virtualization platform to establish a virtualized instance corresponding to the target security device and virtualized instances of other devices in an environment in which the target security device operates according to physical resources required by the operating environment information;
a returning module 305 configured to receive the created management information of the virtualized instance from the network security virtualization platform and return the management information to the user so that the user can use the virtualized instance according to the management information.
In an optional implementation manner of this embodiment, the apparatus further includes:
and a third determining module, configured to determine, after determining that there is a virtualization instance corresponding to an existing idle security device having a target device type according to the related information, that the existing security device is the target security device, and return management information corresponding to the target security device to the user, so that the user can use the target security device and virtualization instances corresponding to other devices in an environment in which the target security device operates according to the management information.
In an optional implementation manner of this embodiment, the apparatus further includes:
and the binding module is configured to bind and store the user identification information and the virtualization instance identification, and mark the use state of the virtualization instance as occupied.
In an optional implementation manner of this embodiment, the apparatus further includes:
and the unbinding module is configured to detect that the user does not use the virtualized instance of the target security device within a preset time period, unbind the user identification information and the virtualized instance identification, and mark the use state of the virtualized instance as idle.
In an optional implementation manner of this embodiment, the apparatus further includes:
a second receiving module configured to receive configuration information of the user for a virtualized instance corresponding to the target security device;
a configuration module configured to configure the target security device according to the configuration information;
a third receiving module, configured to receive a verification request of the user for the configuration information, execute the verification request on the virtualized instance of the target security device according to the configuration information, and return the verification result.
In an optional implementation manner of this embodiment, the configuration information includes at least one of: stand-alone exercise environment configuration information, comprehensive exercise environment configuration information, and confrontation exercise environment configuration information.
In an optional implementation manner of this embodiment, the physical resource includes at least one of: physical machines, servers, routers, and switches; the target security device runs on a virtual machine, and the virtual machine is established on the physical machine; the virtualized instance of the other device includes at least one of: virtual switch, virtual router, virtual server, virtual terminal.
In an optional implementation manner of this embodiment, the target security device includes at least one of: the system comprises a firewall, an intrusion detection device, a vulnerability scanning device, a virus protection system and a patch distribution system.
The network security simulation training device corresponds to the network security simulation training method, and specific details can be referred to the description of the network security simulation training method, which is not described herein again.
Fig. 4 is a block diagram of a network security simulation training system according to an embodiment of the present disclosure. As shown in fig. 4, the network security simulation training system 400 includes: a client 401, a web server 402 and a network security virtualization platform 403; wherein,
the client 401 is used for providing a web interaction interface for a user;
the web server 402 is configured to receive a training request of a target security device sent by the client 401, where the training request at least includes a target device type and user identification information of the target security device called by a user; the web server 402 further determines the related information of the existing security device according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment; the web server 402 is configured to determine, according to the relevant information, after determining that there is no virtualization instance corresponding to the existing idle security device having the target device type, determine, according to the training request, operating environment information of the target device, and send the operating environment information to the network security virtualization platform 403; the web server 402 further receives the management information of the created virtualization instance from the network security virtualization platform 403 and returns the management information to the client 401, so that the user can use the virtualization instance according to the management information through the client 401;
the network security virtualization platform 403 receives the request from the web server 402, and establishes a virtualization instance corresponding to the target security device and virtualization instances of other devices in the environment where the target security device operates according to the physical resources required by the operating environment information in the request.
In an optional implementation manner of this embodiment, the network security virtualization platform includes: a physical layer, a virtual layer, and a device layer; wherein,
the physical layer comprises a physical machine for bearing a virtual machine;
the virtual layer includes a virtual machine built on the physical machine, a virtualized instance of a target security appliance running on the virtual machine,
the device layer comprises a network security simulation training example established on the virtual machine, the virtualization example is used for simulating the operation and configuration process of the security device, and the training network with different topological structures corresponding to the security device is simulated by utilizing virtualization network resources.
In an optional implementation manner of this embodiment, the physical machine includes at least one of: a server, a router and a storage array; the network security simulation training example comprises at least one of the following: the system comprises a firewall, intrusion detection equipment, vulnerability scanning equipment, a virus protection system, a patch distribution system, a virtual server and a virtual client.
For specific details of the network security simulation training system in this embodiment, reference may be made to the above description of the network security simulation training method, which is not described herein again.
Fig. 5 is a schematic structural diagram of an electronic device suitable for implementing a network security simulation training method according to an embodiment of the present disclosure.
As shown in fig. 5, the electronic device 500 includes a processing unit 501, which may be implemented as a CPU, GPU, FPGA, NPU, or the like processing unit. The processing unit 501 may perform various processes in the embodiments of any one of the methods described above of the present disclosure according to a program stored in a Read Only Memory (ROM)502 or a program loaded from a storage section 508 into a Random Access Memory (RAM) 503. In the RAM503, various programs and data necessary for the operation of the electronic apparatus 500 are also stored. The processing unit 501, the ROM502, and the RAM503 are connected to each other by a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.
The following components are connected to the I/O interface 505: an input portion 506 including a keyboard, a mouse, and the like; an output portion 507 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage portion 508 including a hard disk and the like; and a communication section 509 including a network interface card such as a LAN card, a modem, or the like. The communication section 509 performs communication processing via a network such as the internet. The driver 510 is also connected to the I/O interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 510 as necessary, so that a computer program read out therefrom is mounted into the storage section 508 as necessary.
In particular, according to embodiments of the present disclosure, any of the methods described above with reference to embodiments of the present disclosure may be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a medium readable thereby, the computer program comprising program code for performing any of the methods of the embodiments of the present disclosure. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 509, and/or installed from the removable medium 511.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams may represent a module, a program segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units or modules described in the embodiments of the present disclosure may be implemented by software or hardware. The units or modules described may also be provided in a processor, and the names of the units or modules do not in some cases constitute a limitation of the units or modules themselves.
As another aspect, the present disclosure also provides a computer-readable storage medium, which may be the computer-readable storage medium included in the apparatus in the above-described embodiment; or it may be a separate computer readable storage medium not incorporated into the device. The computer readable storage medium stores one or more programs for use by one or more processors in performing the methods described in the present disclosure.
The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention in the present disclosure is not limited to the specific combination of the above-mentioned features, but also encompasses other embodiments in which any combination of the above-mentioned features or their equivalents is possible without departing from the inventive concept. For example, the above features and (but not limited to) the features disclosed in this disclosure having similar functions are replaced with each other to form the technical solution.
Claims (10)
1. A network security simulation training method comprises the following steps:
receiving a training request of target safety equipment sent by a user; the training request at least comprises a target device type and user identification information;
determining related information of the existing safety equipment according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment;
determining running environment information of the target equipment according to the training request after determining that no virtualization instance corresponding to the existing safety equipment which is idle and has the target equipment type exists according to the related information;
sending the running environment information to a network security virtualization platform to request the network security virtualization platform to establish a virtualization instance corresponding to the target security device and virtualization instances of other devices in the running environment of the target security device according to physical resources required by the running environment information;
and receiving the established management information of the virtualization instance from the network security virtualization platform and returning the management information to the user so that the user can use the virtualization instance according to the management information.
2. The method of claim 1, further comprising:
and after determining that the virtualization instances corresponding to the idle existing safety equipment with the target equipment type exist according to the related information, determining the existing safety equipment as the target safety equipment, and returning the management information corresponding to the target safety equipment to the user so that the user can use the target safety equipment and the virtualization instances corresponding to other equipment in the running environment of the target safety equipment according to the management information.
3. The method of claim 1 or 2, further comprising:
and binding and storing the user identification information and the virtualized instance identification, and marking the use state of the virtualized instance as occupied.
4. The method of claim 1 or 2, further comprising:
and when detecting that the user does not use the virtualized instance of the target security device within a preset time period, unbinding the user identification information and the virtualized instance identification, and marking the use state of the virtualized instance as idle.
5. The method of claim 1 or 2, further comprising:
receiving configuration information of a virtualization instance corresponding to the target security equipment by the user;
configuring the target security equipment according to the configuration information;
and receiving a verification request of the user for the configuration information, executing the verification request on the virtualized instance of the target security equipment according to the configuration information, and returning a verification result.
6. The method of claim 5, wherein the configuration information comprises at least one of: stand-alone exercise environment configuration information, comprehensive exercise environment configuration information, and confrontation exercise environment configuration information.
7. A network security simulation training device, comprising:
the first receiving module is configured to receive a training request of a target safety device sent by a user; the training request at least comprises a target device type and user identification information;
a first determination module configured to determine information related to an existing security device according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment;
a second determining module, configured to determine, according to the relevant information, after determining that there is no virtualization instance corresponding to the existing idle security device having the target device type, operation environment information of the target device according to the training request;
a sending module configured to send the operating environment information to a network security virtualization platform to request the network security virtualization platform to establish a virtualized instance corresponding to the target security device and virtualized instances of other devices in an operating environment of the target security device according to physical resources required by the operating environment information;
a return module configured to receive the established management information of the virtualization instance from the network security virtualization platform and return the management information to a user so that the user can use the virtualization instance according to the management information.
8. A network security simulation training system, comprising: the system comprises a client, a web server and a network security virtualization platform; wherein,
the client is used for providing a web interactive interface for a user;
the web server is used for receiving a training request of a client, wherein the training request at least comprises a target equipment type and user identification information of target safety equipment called by a user; the web server also determines the related information of the existing safety equipment according to the training request; the related information at least comprises the number and the use state of the virtualization instances corresponding to the existing security equipment; the web server is used for determining running environment information of the target equipment according to the training request after determining that no virtualization instance corresponding to the existing idle safety equipment with the target equipment type exists according to the related information, and sending the running environment information to a network security virtualization platform; the web server also receives the established management information of the virtualization instance from the network security virtualization platform and returns the management information to the client, so that a user can use the virtualization instance through the client according to the management information;
and the network security virtualization platform receives a request of the web server, and establishes a virtualization instance corresponding to the target security device and virtualization instances of other devices in the operating environment of the target security device according to physical resources required by the operating environment information in the request.
9. The system of claim 8, wherein the network secure virtualization platform comprises: a physical layer, a virtual layer, and a device layer; wherein,
the physical layer comprises a physical machine for bearing a virtual machine;
the virtual layer includes a virtual machine built on the physical machine, a virtualized instance of a target security appliance running on the virtual machine,
the device layer comprises a network security simulation training example established on the virtual machine, the virtualization example is used for simulating the operation and configuration process of the security device, and the training network with different topological structures corresponding to the security device is simulated by utilizing virtualization network resources.
10. The system of claim 9, wherein the physical machine comprises at least one of: a server, a router and a storage array; the network security simulation training example comprises at least one of the following: the system comprises a firewall, intrusion detection equipment, vulnerability scanning equipment, a virus protection system, a patch distribution system, a virtual server and a virtual client.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011304202.7A CN112333025B (en) | 2020-11-19 | 2020-11-19 | Network security simulation training method, device and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011304202.7A CN112333025B (en) | 2020-11-19 | 2020-11-19 | Network security simulation training method, device and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112333025A true CN112333025A (en) | 2021-02-05 |
| CN112333025B CN112333025B (en) | 2023-04-18 |
Family
ID=74321681
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011304202.7A Active CN112333025B (en) | 2020-11-19 | 2020-11-19 | Network security simulation training method, device and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112333025B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115102865A (en) * | 2022-06-27 | 2022-09-23 | 李泽宾 | Network security device topology management method and system |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101188493A (en) * | 2007-11-14 | 2008-05-28 | 吉林中软吉大信息技术有限公司 | Teaching and testing device for network information security |
| CN103220364A (en) * | 2013-04-27 | 2013-07-24 | 清华大学 | Cloud-based system management training platform architecture |
| CN103701777A (en) * | 2013-12-11 | 2014-04-02 | 长春理工大学 | Remote network attack and defense virtual simulation system based on virtualization and cloud technology |
| CN105025067A (en) * | 2014-04-30 | 2015-11-04 | 中国银联股份有限公司 | Information security technology research platform |
| US10079850B1 (en) * | 2015-12-29 | 2018-09-18 | Symantec Corporation | Systems and methods for provisioning cyber security simulation exercises |
| CN109768892A (en) * | 2019-03-04 | 2019-05-17 | 中山大学 | A kind of network security experimental system of micro services |
| CN110098951A (en) * | 2019-03-04 | 2019-08-06 | 西安电子科技大学 | A kind of network-combination yarn virtual emulation based on virtualization technology and safety evaluation method and system |
-
2020
- 2020-11-19 CN CN202011304202.7A patent/CN112333025B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101188493A (en) * | 2007-11-14 | 2008-05-28 | 吉林中软吉大信息技术有限公司 | Teaching and testing device for network information security |
| CN103220364A (en) * | 2013-04-27 | 2013-07-24 | 清华大学 | Cloud-based system management training platform architecture |
| CN103701777A (en) * | 2013-12-11 | 2014-04-02 | 长春理工大学 | Remote network attack and defense virtual simulation system based on virtualization and cloud technology |
| CN105025067A (en) * | 2014-04-30 | 2015-11-04 | 中国银联股份有限公司 | Information security technology research platform |
| US10079850B1 (en) * | 2015-12-29 | 2018-09-18 | Symantec Corporation | Systems and methods for provisioning cyber security simulation exercises |
| CN109768892A (en) * | 2019-03-04 | 2019-05-17 | 中山大学 | A kind of network security experimental system of micro services |
| CN110098951A (en) * | 2019-03-04 | 2019-08-06 | 西安电子科技大学 | A kind of network-combination yarn virtual emulation based on virtualization technology and safety evaluation method and system |
Non-Patent Citations (1)
| Title |
|---|
| YANGXIN TENG: "Research on the application of openstack to build a new heterogeneous real-time virtual cloud to reproduce application vulnerability and training demonstration architecture" * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115102865A (en) * | 2022-06-27 | 2022-09-23 | 李泽宾 | Network security device topology management method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112333025B (en) | 2023-04-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103493061B (en) | For the method and apparatus tackling Malware | |
| KR101460589B1 (en) | Server for controlling simulation training in cyber warfare | |
| Ficco et al. | Leaf: An open-source cybersecurity training platform for realistic edge-IoT scenarios | |
| CN108965021B (en) | Method and device for creating virtual drilling network | |
| CN110351228A (en) | Remote entry method, device and system | |
| CN105760724B (en) | Sharing method, equipment and the system of game role | |
| CN114268508B (en) | Internet of things equipment security access method, device, equipment and medium | |
| Lucas et al. | An initial framework for evolving computer configurations as a moving target defense | |
| CN108605264A (en) | Network management | |
| CN110875899B (en) | Data processing method, system and network system | |
| CN117610026B (en) | Honey point vulnerability generation method based on large language model | |
| CN112333025B (en) | Network security simulation training method, device and system | |
| Janisch et al. | Nasimemu: Network attack simulator & emulator for training agents generalizing to novel scenarios | |
| CN104978257B (en) | Computing device elasticity methods of marking and device | |
| Yeom et al. | Scenario-based cyber attack· defense education system on virtual machines integrated by web technologies for protection of multimedia contents in a network | |
| CN103841091B (en) | safety login method, device and system | |
| CN112866036B (en) | Network flow simulation method and system of cloud computing platform and computer storage medium | |
| ben Othmane et al. | Incorporating lab experience into computer security courses | |
| KR102130807B1 (en) | Apparatus and method for providing cyber security training content | |
| KR102223775B1 (en) | Control system for cyber warfare training and control method thereof | |
| CN115913572A (en) | Data verification method, device, equipment, medium and system for mimicry storage system | |
| Katsikeas et al. | Empirical evaluation of a threat modeling language as a cybersecurity assessment tool | |
| Boukhriss et al. | New technique of localization a targeted virtual machine in a Cloud Platform | |
| Alnaim et al. | A Misuse Pattern for Distributed Denial-of-Service Attack in Network Function Virtualization | |
| KR102130805B1 (en) | Apparatus and method for providing cyber security training content |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |